Subject: Re: Security requirements for identification

From: Juan Rodriguez Hervella <[email-masked]>
Date: Wed, 1 Oct 2003 12:03:05 +0200

On Wednesday 01 October 2003 00:31, Erik Nordmark wrote:
> > As you mention, there are multiple times that i don't really need to know
> > the identifier of the end-point that i want to communicate to, but what i
> > want is the identifier of the service that i want to contact (is this
> > what you meant?)
>
> Yep.

Hello,

I'm trying to follow this thread, which seems very interesting, but I'm 
surprised with this statement. IMO when you make a DNS query
you want to get the identifier of the end-point, to be able to start
the communication. Although it's true that the name usually
gives hints about the service, this isn't always true. If you
need "www.google.com", you already know that the service will
be "HTTP". You don't ask the DNS for the service, what you really
need to know is the address of "google" to start the HTTP transfer.

Don't you agree with this ?

Cheers.

-- 
JFRH

---

From: "Spencer Dawkins" <[email-masked]>
Date: Wed, 1 Oct 2003 09:18:56 -0500

Dear Juan,

I'm also a little confused by the discussion, but I had assumed that
we had a service name and were using DNS SRV records, which also
include port numbers, etc. Not sure how a computer knows
www.google.com is HTTP - or how travel.yahoo.com is also HTTP, if
you're keying off the name...

But somebody can tell us what they REALLY meant now.

Spencer

----- Original Message ----- 
From: "Juan Rodriguez Hervella" <[email-masked]>
To: "Erik Nordmark" <[email-masked]>; <[email-masked]>
Cc: "Erik Nordmark" <[email-masked]>; "Pekka Nikander"
<[email-masked]>; "Multi6 WG" <[email-masked]>;
<[email-masked]>
Sent: Wednesday, October 01, 2003 5:03 AM
Subject: Re: Security requirements for identification

---

From: Juan Rodriguez Hervella <[email-masked]>
Date: Wed, 1 Oct 2003 18:00:10 +0200

> you're keying off the name...

Uh I didn't realize of the existence of DNS SRV records... they
might be talking about that. 

I was thinking about human-machine
interaction which is what most users daily do with computers, i. e,
they open IExplore, they usually type a name and everything ends up well...
IExplore knows the service because it reads the URL. IMO applications
know in advance the service that has to be used (service = port),
so they only need to find the "remote end-point" to start the communication 
with. Not 100% of the applications behave like this, I know, but what I 
wanted to note is that the DNS is used mainly for identification/location
purposes, it is *not* a service lookup....

Anyway, I think this talk  is to be "off topic" in this thread. What I really
would like to know is what they REALLY meant, cause I'm not understanding
a thing (lol)

Cheers ^--^

> Hello,
>
> I'm trying to follow this thread, which seems very interesting, but
>
> I'm
>

-- 
JFRH

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 2 Oct 2003 00:56:02 +0200 (CEST)

> need to know is the address of "google" to start the HTTP transfer.

Perhaps the "service" vs. "hostname" is confusing. It isn't about the upper
layer protocols in any case.

The issue is that today when you ask for A (or AAAA) records for a given fqdn
you might get back multiple answers, but it isn't clear whether the multiple
answers are
 - multiple IP address for the same host/endpoints (i.e. the entity which
holds 
   the TCP and application state),
 - multiple IP addresses for the service but implemented by different endpoints
 - some combination (6 IP addresses for 3 hosts which each have 2 IP addresses)
 This distinction is important for multi6, since you don't want to try to
failover your TCP/application communication to an endpoint which doesn't have
the  TCP/application state.

Is that more clear?

  Erik